Core Security Concepts

• This presentation covers core security concepts, security failures, attacks, vulnerabilities, and defense mechanisms.
• It also touches on risk assessment and security mechanism summaries.

Security Properties

• Confidentiality protects data from unauthorized access.
• Privacy ensures control over personal information collected about individuals.
• Integrity protects data from unauthorized alteration.
• System Integrity ensures the system performs its intended functions correctly.
• Availability protects against denial of access to data or systems, which can be caused by resource overuse or vandalism.
• Authenticity protects against data or identity impersonation.
• Accountability associates actions with a specific entity in a unique way.

Reliability Failure

• Sequence of reliability failure is: fault leading to an error, which in turn causing a failure.

Flaw in Security

• Sequence of security failure is: an attack combined with a vulnerability leads to intrusion.
• Intrusion will then result in errors, followed by failure.
• Attackers introduce malicious faults into a system to exploit vulnerabilities.
• Vulnerabilities are system weaknesses that make it susceptible to attacks.

Attacks

• There are intentional malicious faults introduced into a system with the intent of exploiting vulnerabilities.
• Without attacks, vulnerabilities are harmless.
• Without vulnerabilities, attacks are unsuccessful.
• Intrusion is an operational fault induced by external malicious intent, causing an erroneous state in the system.

Hacker Motivations

• Reasons for hacking includes curiosities, collecting trophies and free computer access.
• They can use the free access to bridge to other machines, to obtain confidential information or to sabotage or damage systems for criminal and political reasons.
• It can also include cyberwarfare.

Threats, Consequences, and Actions (Attacks)

• Threats can have consequences, due to actions/attacks

Hacker Methodology

• Hackers start with reconnaissance to discover potential vulnerabilities by exploring public sources for information about the organization and relevant systems.
• Hackers gets to know the target with what computers and software are available, and start looking for weak spots.
• Attacking is done after gathering information.
• The most common access methods are email, web, or memory devices.

Steps after Access

• After gaining initial access, hackers aim to control the system and escalate privileges to gain administrative rights.
• Hackers will hide activities during their intrusion.
• They attempt is made to remove logs after exiting

Maintaining Access

• This stage involves installing backdoors and software.
• The goal is to provide convenient access in the future.

Compromising other organization systems

• Hackers will look for "trophies."
• They also look for other systems that will help them get more access.
• They search for access information in personal files.
• Hackers will listen to info from the access the machine has

Information Pilfering

• Hackers will retrieve sensitive information and change or erase data.

Strategies for system protection

• Understand systems, including linked devices and running software, to effectively protect against vulnerabilities.
• Testing ensures the system is clean from all outside influence and properly setup.

Attack Types

• Passive attacks obtains existing system data without affecting resources.
• Active attacks attempts to alter system operations.
• External attacks are conducted by unauthorized entities outside the security perimeter.
• Internal attacks are done by entities within the security perimeter, possessing potential privileges.

Passive Attacks Characteristics

• Passive attacks focus on confidentiality without direct contact with systems of protection.
• Sniffing involves unauthorized traffic listening.
• Traffic analysis derives information from intercepted traffic characteristics without traffic analysis.
• "Snooping” involves searching systems for passwords or configurations.
• Probing analyses the existence of information from probe systems.
• Passive attacks are less visible compared to active attacks

Sniffing

• Sniffing network adapters are set to promiscuous mode.
• All incoming Ethernet-frames are listened.
• Useful traffic is being stored for future use.
• It is difficult to track

Active Attacks

• Active attacks manipulate the system to corrupt data.
• Active attacks include address spoofing, IP, MAC address manipulation, data modification and replay, and blocking communication.
• Executing maleware is one way attacks can be executed.
• Malware are; Viruses, Worms, Logic Bombs, Trojans, Zombies / Bots

Spoofing Characteristics

• Spoofing is when someone or something pretends to be an entity for data falsification.
• Spoofing often is related to email, IP, and MAC addresses.

Man-in-the-Middle

• A machine intercepts data between two sides, modifying data it sees.
• Some examples are replay data and messaging.
• It will also show modified malicious code.

Computer Viruses

• Computer viruses are programs inserted into one or more files and execute malicious actions.
• Viruses execute by other files and they make it execute.
• It includes self-replicating code alongside malicious ones.
• Replication spreads copies.
• Execution triggers events to cause damage.
• Virus is dormant until an activation event occurs.

Computer Worms

• Worms copy themselves among computers, spreading through a network and consuming resources without infecting files.
• Replication replicates between systems.
• Execution is controlled by specific activation events.
• Worms replicate via other file sharing, where viruses replicate on one sharing platform.

Logic Bomb

• A logic bomb executes a security breach after an outside event happens
• Logic bombs are usually encoded in authentic or worm files.
• It causes damage.
• Activation conditions change the database.

Trojan Horse

• A Trojan is an application that secretly does something bad when you run it
• Users may find new passwords through login.
• Data is stored to secret folder.
• Trojans spread viruses and backdoors.

Zombies / Bots

• Zombies allow foreign influences on network computers.
• They remain sleeping through exploit of system.
• Zombies start being activated through remote connection access.
• Bots start indirect attacks while spamming.
• The collection of zombies is called BotNets, DDoS (distributed denial of Service) uses BotNets.
• It's being recorded that there are around 1.000.000 computers in Networks.

Relevant Attacks

• Some attacks can be seen in the Breadcom Security Center.
• Some others are DOS / DDOS (denial of service) and malware.
• Cyber warfare can cause these things.
• infrastructures have more attacks.
• These attacks get democratized by "scripty kids.

Vulnerabilities vs Protection Mechanisms

• There are technical and social system vulnerabilities.

Protection Against Security Failures

• Prevention reduces vulnerabilities and stops any successful attacks.
• Intrusion detection helps intrusion
• Recovery limits attacks and resets system state

Intrusion threats

• Risk equals probability of attack x vulnerability, the risk metric accounts for any system vulnerability
• Correcting vulnerabilities depends on severity.

Security Mechanisms

• It covers encryption, confinements, firewalls, access control, and privileged execution

Design Principles

• Design has to work based on the Open design
• When there is more time, the more the design will be revealed.
• Economy is important and should be cheap.
• Interposition all access points get checked in case of security

Design Principles (cont.)

• Use of minimal privilege, use only what is needed.
• Modular and compartmentalized coding provides encapsulation.
• Multiple overlapping security systems offers layered protection.

Explore core information security concepts, common failures, attacks, and vulnerabilities. Learn how to implement defense mechanisms and understand risk assessment. The presentation explains security properties, reliability failure, and flaws in security.